3 ms·

It's a really stupid bug, and a somewhat dangerous vulnerability, but hopefully places like airports have IT teams in place that are at least competent enough t

It's a really stupid bug, and a somewhat dangerous vulnerability, but hopefully places like airports have IT teams in place that are at least competent enough to put these devices on a separate VLAN and locking it down. On average, my guess is that small businesses are more vulnerable to this, but that's mitigated by them being less likely to be targeted by a hack this sophisticated. That being said, incompetence can be found everywhere, and obviously it's important for the vulnerability to be fixed.

drzaiusapelord 11y ago
>IT teams in place that are at least competent enough to put these devices on a separate VLAN and locking it down. The problem here is that the way this stuff has grown through the past 50+ years is that IT does "computers" and facilities does "physical security." These realms of responsibility have been seperate, but now are really IT. Now that everything is tcp/ip, well, everything is "computers" now but many organizations struggle with this. IT departments aren't given these responsibilities and old school bureaucrats and rent-seekers don't want to give this to IT. So a lot of these largely blue collar types just call in some vendor who they can't judge nor can they question in regards to technical topics (yeah networking, PoE devices, IoT, remote connectivity, etc is a bit different than running analog doorbell cable that clicks doors open). I had this fight recently at work. It was a political shitstorm about IT replacing the old school phone system with a proper VOIP system and to take over physical security keycards. This fight only ended when the VP in charge of those things retired. These people don't want to modernize and if they do, they'll do their best not to do it with IT. They'll just call some shit vendor who will take them for a ride and security will absolutely not be a concern. Of course that'll be easy to hack. No one is auditing this, setting up vlans, applying patches, auditing products before buying them, etc. We're in this ugly transition stage where everything is going to be a 'smart' device, but the people who are used to dumb devices are still employed. They can't be retrained and they don't want to be. Until these people retire, expect more stupidly simple physical security exploits. This is going to be at anything government or union run. The protectionism, corruption, incompetence, etc will stymy any attempt at best practices, so no surprise to see airports in this article.
- tallanvor 11y ago
  It's fair enough to note that IT may not own these systems, but they still have to interact with IT infrastructure at some point. But you're also right that politics can make things much more difficult than they should be. The article doesn't specifically state that any airports or other sites are vulnerable, just that they could be.
  - drzaiusapelord 11y ago
    You'd think so, but 'building operations' just buys their own internet line and off they go. These large organizations are all silo'd. I suspect we're blaming IT for a lot of things they have no jurisdiction over. In fact, have you seen some of these automation sites? They're geared towards tradespeople and not towards IT. They know who their customers are.
astrobe_ 11y ago
One thing to note is that one has to gain physical access to the network (i.e. find a network plug) to perform the attack. The door controllers might be the least of your worries if this happens.

drzaiusapelord 11y ago

>IT teams in place that are at least competent enough to put these devices on a separate VLAN and locking it down. The problem here is that the way this stuff has grown through the past 50+ years is that IT does "computers" and facilities does "physical security." These realms of responsibility have been seperate, but now are really IT. Now that everything is tcp/ip, well, everything is "computers" now but many organizations struggle with this. IT departments aren't given these responsibilities and old school bureaucrats and rent-seekers don't want to give this to IT. So a lot of these largely blue collar types just call in some vendor who they can't judge nor can they question in regards to technical topics (yeah networking, PoE devices, IoT, remote connectivity, etc is a bit different than running analog doorbell cable that clicks doors open). I had this fight recently at work. It was a political shitstorm about IT replacing the old school phone system with a proper VOIP system and to take over physical security keycards. This fight only ended when the VP in charge of those things retired. These people don't want to modernize and if they do, they'll do their best not to do it with IT. They'll just call some shit vendor who will take them for a ride and security will absolutely not be a concern. Of course that'll be easy to hack. No one is auditing this, setting up vlans, applying patches, auditing products before buying them, etc. We're in this ugly transition stage where everything is going to be a 'smart' device, but the people who are used to dumb devices are still employed. They can't be retrained and they don't want to be. Until these people retire, expect more stupidly simple physical security exploits. This is going to be at anything government or union run. The protectionism, corruption, incompetence, etc will stymy any attempt at best practices, so no surprise to see airports in this article.

tallanvor 11y ago
It's fair enough to note that IT may not own these systems, but they still have to interact with IT infrastructure at some point. But you're also right that politics can make things much more difficult than they should be. The article doesn't specifically state that any airports or other sites are vulnerable, just that they could be.
- drzaiusapelord 11y ago
  You'd think so, but 'building operations' just buys their own internet line and off they go. These large organizations are all silo'd. I suspect we're blaming IT for a lot of things they have no jurisdiction over. In fact, have you seen some of these automation sites? They're geared towards tradespeople and not towards IT. They know who their customers are.

astrobe_ 11y ago

One thing to note is that one has to gain physical access to the network (i.e. find a network plug) to perform the attack. The door controllers might be the least of your worries if this happens.